What is CVE-2023-21417?

CVE-2023-21417 is a vulnerability in the VAPIX API manageoverlayimage.cgi in AXIS OS that allows for path traversal attacks and file/folder deletion.

How severe is CVE-2023-21417?

CVE-2023-21417 has a severity score of 7.1, indicating a high severity.

Which software versions are affected by CVE-2023-21417?

The vulnerability affects Axis OS versions 11.7.57 and below, Axis OS 2020 versions 9.80.49 and below, and Axis OS 2022 versions 10.12.208 and below.

Is there a fix for CVE-2023-21417?

Yes, to fix CVE-2023-21417, it is recommended to update to a version of Axis OS that is not affected by the vulnerability.

Vulnerability/
CVE-2023-21417

high

7.1

CWE

21/11/2023

28/11/2023

CVE-2023-21417: Path Traversal

Q: How can CVE-2023-21417 be exploited?

CVE-2023-21417 can be exploited by authenticating with an operator- or administrator-privileged service account and performing path traversal attacks to delete files and folders.

First published: Tue Nov 21 2023(Updated: )

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder deletion. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account. The impact of exploiting this vulnerability is lower with operator service accounts and limited to non-system files compared to administrator-privileges. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Credit: product-security@axis.com

Affected Software	Affected Version	How to fix
Axis Axis Os	<11.7.57
Axis Axis Os 2020	<9.80.49
Axis Axis Os 2022	<10.12.208

Never miss a vulnerability like this again

Reference Links

https://www.axis.com/dam/public/2a/82/12/cve-2023-21417-en-US-417791.pdf

Frequently Asked Questions

What is CVE-2023-21417?
CVE-2023-21417 is a vulnerability in the VAPIX API manageoverlayimage.cgi in AXIS OS that allows for path traversal attacks and file/folder deletion.
How severe is CVE-2023-21417?
CVE-2023-21417 has a severity score of 7.1, indicating a high severity.
Which software versions are affected by CVE-2023-21417?
The vulnerability affects Axis OS versions 11.7.57 and below, Axis OS 2020 versions 9.80.49 and below, and Axis OS 2022 versions 10.12.208 and below.
How can CVE-2023-21417 be exploited?
CVE-2023-21417 can be exploited by authenticating with an operator- or administrator-privileged service account and performing path traversal attacks to delete files and folders.
Is there a fix for CVE-2023-21417?
Yes, to fix CVE-2023-21417, it is recommended to update to a version of Axis OS that is not affected by the vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.